PatchTheCVECVE-2026-54277: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-54277 is a high-severity flaw (CVSS 7.5) affecting aiohttp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 53%) |
| CISA exploited list | No |
| Weakness | CWE-770 |
| Published | 2026-06-22 |
| Last modified | 2026-10-25 |
Last updated 2026-10-25 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-54277?
aiohttp: upgrade to 3.14.1. Exact commands for each OS are on this page.
Is CVE-2026-54277 being exploited?
CVE-2026-54277 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-54277 affect?
CVE-2026-54277 affects aiohttp. Severity is high (CVSS 7.5). AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in p
How urgent is CVE-2026-54277?
Priority 43/100. High severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-34515 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-34516 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54274 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-50269 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
- CVE-2026-54273 HIGH 7.5 UPGRADE AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python